Microsoft 365 & Google Workspace Security Review
For most small and mid-sized businesses, Microsoft 365 or Google Workspace is where email, documents and identities live. That also makes it the first place attackers try. A stolen password without MFA, a mailbox rule that forwards invoices, or a document shared with "anyone with the link" can lead to fraud or a data breach.
Mutex Systems reviews your tenant against the CIS Microsoft 365 and Google Workspace benchmarks. We check identity, Conditional Access, email security, sharing, admin roles and logging, then help you fix what we find without locking anyone out.
Or call our London office on 020 3307 529901Why it matters now
The risk behind this service
Based on incidents and figures in our UK & Europe threat report.
- Business email compromise and invoice fraud start with a single taken-over mailbox. Strong identity controls stop most of it.
- Cyber Essentials requires MFA on cloud services, and insurers increasingly ask about it.
- Default settings favour easy sharing. Over time, sensitive files end up open to people outside the company.
Who this is for
- SMEs running on Microsoft 365 or Google Workspace
- Firms preparing for Cyber Essentials or Cyber Essentials Plus
- Finance, legal and professional services firms targeted by invoice fraud
- Organisations after a phishing incident or mailbox compromise
- Companies merging tenants after an acquisition
- IT teams wanting to raise Microsoft Secure Score
02Services
What we deliver
Identity & MFA Review
MFA coverage, phishing-resistant methods, legacy authentication, guest accounts and break-glass accounts.
Conditional Access Design
Policies for device compliance, location, risk and admin access, tested in report-only mode before enforcement.
Email Security
SPF, DKIM and DMARC, anti-phishing and anti-spoofing policies, Safe Links and attachments, and suspicious forwarding rules.
Sharing & Data Protection
SharePoint, OneDrive, Teams and Google Drive sharing, sensitivity labels and data loss prevention.
Admin Role Review
Global and super-admin accounts, privileged identity management (PIM) and role separation.
Logging & Alerting
Unified audit log, alert policies and Defender or Workspace alert center coverage, connected to your SOC.
Learn moreDevice & Endpoint Settings
Intune or Google endpoint management baselines for laptops and mobiles.
Remediation Support
We implement fixes with your team in planned stages, so users are not locked out.
03Business impact
What a tenant security review changes
How a reviewed and hardened tenant compares with default settings.
| Factor | Default tenant settings | ● After a Mutex review |
|---|---|---|
| Fraud risk | A single phished password can lead to invoice fraud. | MFA, Conditional Access and forwarding controls block most account takeovers. |
| Data exposure | Files shared publicly or with ex-staff remain accessible. | Sharing restricted and sensitive data labelled and protected. |
| Cost | Paid security features already in your licence go unused. | Existing licence features switched on before buying new tools. |
| Certification | Cyber Essentials questions on MFA and admin accounts fail. | Settings aligned with Cyber Essentials and CIS benchmarks. |
| Investigation | Audit logs missing when an incident needs investigating. | Logging and alerts on, and connected to monitoring. |
04How it works
How an engagement runs
- 1
Read-only access
Connect with a read-only reviewer role; no changes are made during the review.
- 2
Benchmark scan
Check the tenant against CIS benchmarks and Secure Score recommendations.
- 3
Expert review
Engineers check identity, email, sharing, roles and logging in business context.
- 4
Report & plan
Prioritised findings and a staged rollout plan that avoids user disruption.
- 5
Fix & verify
Optional hands-on remediation, then a re-check to confirm improvements.
What you receive
- Tenant risk summary for management
- CIS benchmark results and Secure Score before and after
- Conditional Access and MFA design
- Email authentication (SPF, DKIM, DMARC) configuration
- Staged remediation plan and verification report
05Compliance
Frameworks and regulations this supports
Cyber Essentials
MFA for cloud services, admin account control and secure configuration.
CIS Controls
CIS Microsoft 365 and Google Workspace benchmarks set the baseline.
ISO 27001:2022
Access control (5.15 to 5.18) and secure authentication (8.5).
UK GDPR
Appropriate technical measures to protect personal data in email and files.
SOC 2
Logical access controls in the Security criteria.
NIST CSF 2.0
Protect function: identity management and access control.
grComply · GRC platform
Keep your tenant secure after the review
grComply tracks each tenant finding to closure and records the configuration as evidence for Cyber Essentials, ISO 27001 and SOC 2, so the next audit does not start from screenshots.
Explore grComply- Findings with owners and due dates
- Evidence mapped to Cyber Essentials, ISO 27001 and SOC 2
- Policy acknowledgement for staff
- Re-checks scheduled to catch drift
What does a Microsoft 365 security review cover?
Identity and MFA, Conditional Access, email security including SPF, DKIM and DMARC, SharePoint, OneDrive and Teams sharing, admin roles, data protection, logging and device settings, benchmarked against CIS.
Will the review change our settings?
No. The review uses read-only access. Any changes happen only in the remediation stage, with your approval and in planned steps.
Do you review Google Workspace too?
Yes. We review Google Workspace against the CIS Google Workspace benchmark, covering 2-Step Verification, admin roles, Drive sharing, Gmail security and audit logs.
Will this help us pass Cyber Essentials?
Yes. Many Cyber Essentials failures relate to cloud services: missing MFA, too many admin accounts or insecure settings. The review fixes these before assessment.
Can you raise our Microsoft Secure Score?
Yes. We use Secure Score as one measure, but we prioritise the changes that reduce real risk rather than chasing points.
How long does it take?
A review of a typical SME tenant takes days rather than weeks. Remediation depends on how many changes you want and how quickly users can be moved to new settings.
What licences do we need?
Many important controls work on standard business licences. Some, such as risk-based Conditional Access and PIM, need higher tiers. We show what you can do with what you already pay for.
Close the gaps in your Microsoft 365 or Google Workspace
Tell us your platform and user count. Reply within one working day, or call 020 3307 5299.